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Intomolional 
Orgonization  for 
Stondardization 


Abstract 


The  latest  CMMI-DEV  version  1 .3  shows  over  50 
instances  of  Quality  Assurance  (QA).  It  is  clear  that 
CMMI-DEV  and  IEEE  730  SQA  need  to  align.  The  P730 
IEEE  standards  working  group  has  expanded  the  scope 
of  the  SQA  process  standard  to  align  with  IS  12207 
software  life  cycle  processes. 

Presentation  will  cover  IEEE  730  CMMI  appendix  on 
implementation  if  your  organization  uses  the  CMMI-DEV 
framework.  We  welcome  audience  feedback  and 
support  to  enhance  this  IEEE  730  guidance 


IS:  International  Standard,  lEEE/ISO/lEC 


Life  Cycle  Process  frameworks 


©2011  Walz 


IEEE  Life  Cycle  Processes  &  Artifacts 

Systems  Life  Cycle  Processes  (IS  15288) 

-  25  processes  including 

•  life  cycle  management  process 

•  software  implementation 

Software  Life  Cycle  Processes  (IS  12207) 

- 18  processes:  Implementation,  Technical, 

Reuse,  &  Support 

•  Support  processes  include  Software  QA  (SQA) 

Life  Cycle  Information  Products  (IS  15289) 

•  assist  users  to  manage  information  items  as  products 
of  the  system  or  software  life  cycle  processes 
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CMMI  Life  Cycle  Process  Areas 

•  CMMI  Architecture  and  Framework 

-  CMMI®  for  Acquisition,  ACQ 

•  22  process  areas 

-  include  process  &  product  quality  assurance,  PPQA 

-CMMI®  for  Services,  SVC 

•  24  process  areas 

-  include  process  &  product  quality  assurance,  PPQA 

-  CMMI®  for  Development,  DEV 

•  22  process  areas 

-  including  process  &  product  quality  assurance,  PPQA 

CMMI 
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IEEE  Life  Cycle  Process  groups 

System  Context  Processes  Software  Specific  Processes 

Technical 
Processes 

stakeholder 
Requirements  Definition 
Process  (Clause  6.4.1) 


System  Requirements 
Analysis  Process 
(Clause  6.4.2) 


System  Architectural 
Design  Process 
(Clause  6.4.3) 


Implementation  Process 
(Clause  6.4.4) 


System  Integration 
Process 
(Clause  6.4.5) 


System  Qualification 
Testing  Process 
(Clause  6.4.6) 


Software  Installation 
Process 
(Clause  6.4.7) 


Software  Acceptance 
Support  Process 
(Clause  6.4.8) 


Software  Operation 
Process 
(Clause  6.4.9) 


Software  Maintenance 
Process 
(Clause  6.4.10) 


Software  Disposal 
Process 
(Clause  6.4.11) 


©IEEE 


Agreement 

Processes 


Acquisition  Process 
(Clause  6.1.1) 


Supply  Process 
(Clause  6.1.2) 


Organizational 

Project-Enabling 

Processes 

Life  Cycle  Model 
Management  Process 
(Clause  6.2.1) 


Infrastructure 
Management  Process 
(Clause  6.2.2) 


Project  Portfolio 
Management  Process 
(Clause  6.2.3) 


Human  Resource 
Management  Process 
(Clause  6.2.4) 


Quality  Management 
Process 
(Clause  6.2.5) 


Project 

Processes 


Project  Planning  Process 
(Clause  6.3.1) 


Project  Assessment  and 
Control  Process 
(Clause  6.3.2) 


Decision  Management 
Process 
(Clause  6.3.3) 


Risk  Management 
Process  (Clause  6.3.4) 


Configuration 
Management  Process 
(Clause  6.3.5) 


Information  Management 
Process 
(Clause  6.3.6) 


Measurement  Process 
(Clause  6.3.7) 


SW  Implement¬ 
ation  Processes 

Software  Implementation 
Process 
(Clause  7.1.1) 


Software  Requirements 
Analysis  Process 
(Clause  7.1.2) 


Software  Architectural 
Design  Process 
(Clause  7.1.3) 


Software  Detailed  Design 
Process 
(Clause  7.1.4) 


Software  Construction 
Process 
(Clause  7.1.5) 


Software  Integration 
Process 
(Clause  7.1.6) 


Software  Qualification 
Testing  Process 
(Clause  7.1.7) 


SW  Support 
Processes 

Software  Documentation 
Management  Process 
(Clause  7.2.1) 

Software  Configuration 
Management  Process 
(Clause  7.2.2) 

Software  Quality 
Assurance  Process 
(Clause  7.2.31 

Software  Verification 
Process 
(Clause  7.2.4) 

Software  Validation 
Process 
(Clause  7.2.5) 

Software  Review  Process 
(Clause  7.2.6) 

Software  Audit  Process 
(Clause  7.2.7) 

Software  Problem 
Resolution  Process 
(Clause  7.2.8) 

Software  Reuse  Processes 


Domain  Engineering 
Process 
(Clause  7.3.1) 

Reuse  Program 
Management  Process 
(Clause  7.3.3) 

Reuse  Asset 

Management  Process 

(Clause  7.3.2) 
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CMMI-DEV 
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Process  Areas 


Ortuni/atunul 
Process  Focus 


OrgauiL/ntiun 

Pnxrcss 

Dcfirution 


Project  PUniiiiig 


Priijcct 

Monitoring  and 
CoiilTiil 


Rcquircmi-iits 

Dcsclopmcnt 


Rcquiivtncnrs 

Mnaigcmcnl 


<.  unrigurHiion 
Management 


I'rntos  and 
Product  Ouatiljr 
AssuiaiK 


idA 

.lu,  I 


Orgoni/atHnul 

Supplier 

training 

Agrccmcnl 

s _ > 

Management 
'c _ _ _ / 

OriunizatH'tvil 

Pnx«ss 

Pcrfonnancc 


Integrated 

Prcxfuct 

Project 

Integration 

Management 

s _ > 

Orgam/ational 
Fnvironment  for 

Intcention 

V _ _ _ / 


Organiz-stiotkil 
Inm'vauon  and 
Deployment 


Risk 

^  \  ent'ieution 

Management 

i  : 

L _ ) 

^  y 

IXXISUKI 
Analysis  and 
Resolution 


Integrated 

Teaming 


Validation 


('nuuil  Analysis 
and  RcMilution 


Integrated 

Supplier 

Management 


.v».1 

CMM! 


buildsecurityin.us-cert.gov 


©  Carnegie  Mellon  University  2005-2011 


Quantitolisc 

Project 

Management 
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IEEE  Life  Cycle  Processes 
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CMMI  Model  Components 


(sjbpracti^ 


(^^^Subpractice^ 


generic  Practic^ 
xBaborations/ 


©  Carnegie  Mellon  University  2005-2011 


CMMI 

10 


Processes  and  Products  QA 


ISO/IEC/IEEE 

Process  ^  Activities  ^  Tasks  ^  Artifacts,  Records,  Documents  (Plans) 


IEEE  730  SQA  Process-201 1  IEEE  730  SQA  Plan-2002,  201 1 

CMMI-DEV  V1.3 

Process  Area  ^  Goals  ^  Practices  ^  Artifacts,  Records,  Documents  (Plans) 
PPQA  Process  &  Product'oA'^^ 

VER  Verification  X  SG  Process  Specific  Goal 

GP  Generic  Practices  SP  Process  Specific  Practices 
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Basic  Support  Process  Areas 


€> 

CMMi 


/ 


Quality  and 
noncompliance 


issues 


Processes  and 
j  work  products, 
'  standards,  and 
procedures 


CM  =  Configuration  Management 
MA  =  Measurement  and  Analysis 
PPQA  =  Process  and  Product  Quality  Assurance 
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€> 

Engineering  Process  Areas  cmmi 


Project  Management 
process  areas 


Product  and 
product  component 
requirements 


Requirements 


Customer  needs 


PI  =  Product  Integration 

RD  =  Requirements  Deveiopment 

TS  =  Technicai  Soiution 

VAL  =  Vaiidation 

VER  =  Verification 
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Process  and  Product 
Quality  Assurance  -  SGs 


Relevant 

Stakeholders 


•Project  Manager 
•Sr.  Managers 
•Team  Members 
•Other  functional  areas 


SG  1 :  Objectively  Evaluate  Processes  and  Work 

Products 

Objectively 


1  Objectively  \ 

/  Evaluate  \ 

I  Evaluate  I 

1  Work  1 

V  Processes  / 

V  Products  / 

&  Services 

Reports  and  Records^ 
Provide  Objective  Insight  I 


Communicate^ 
and  Ensure 
Resolution  of 
Noncompliancey 
Issues 


Systems  Engineering  Process  Office  -  SSC  San  Diego,  US  Navy 
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CMMI 


Verification  -  SGs 


CMMI 


SG  1 :  Prepare  for  Verification 


Verification  Environment 
Verification  Procedures  and  Criteria 
List  of  Work  Products  ” 

Seiected  for  Verification 


I 


SG  3:  Verify  Selected  Work  Products 


Verification  Resuits 
Deficiencies 
Verification  Data 
Corrective  Actions 


SG  2:  Perform  Peer  Reviews 

Analyze 
Peer  Reviei 

Requirement  for  DataV  Data 
Collection 

Entry  and  Exit  Criteria 
Peer  Review  Plan 


Review  Results 
Review  Issues 
Review  Data 
Action  Items 


Systems  Engineering  Process  Office  -  SSC  San  Diego,  US  Navy 
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CMMI-DEV  PPQA&  VER 
Specific  Goals  (SGx)  &  Specific  Practices  (SPx.y) 


CMMI-DEV  v1 .3  PPQA  &  VER 
Specific  Goais  (SG) 

PPQA  &  VER  Specific  Practices  (SP) 

PPQA  SP1.1  Objectively  evaluate  selected  performed 
processes  against  applicable  process  descriptions, 
standards,  and  procedures. 

PPQA  SG  1  Adherence  of  the  performed 
process  and  associated  work  products  and 
services  to  applicable  process  descriptions, 
standards,  and  procedures  is  objectively 
evaluated. 

PPQA  SP1 .2  Objectively  evaluate  selected  work  products 
against  applicable  process  descriptions,  standards,  and 
procedures. 

PPQA  SP  2.1  Communicate  quality  issues  and  ensure  the 
resolution  of  noncompliance  issues  with  the  staff  and 
managers. 

PPQA  SG  2  Noncompliance  issues  are 
objectively  tracked  and  communicated,  and 
resolution  is  ensured. 

PPQA  SP  2.2  Establish  and  maintain  records  of  the  quality 
assurance  activities. 

VER  SG  1  Preparation  for  verification  is 
conducted. 

VER  SP  1 .1  Select  work  products  to  be  verified  and 
verification  methods  to  be  Used 

VER  SG  2  Peer  reviews  are  performed  on 
selected  work  products. 

VER  SP  2.2  Conduct  peer  reviews  of  selected  work  products 
and  identify  issues  resulting  from  these  reviews. 

VER  SG  3  Selected  work  products  are  verified 
against  their  specified  requirements. 

VER  SP  2.3  Analyze  data  about  the  preparation,  conduct, 
and  results  of  the  peer  reviews 

VER  SP  3.2  Analyze  results  of  all  verification  activities 

©2011  Walz  16 


P730  SQA  Outcomes  -  CMMI  Goals 


IEEE  730  has  four  outcomes  which  related  to  CMMI  Goals 


P730  /  IS  12207  SQA  Outcomes 

CMMI-DEV  Goals 

a)  a  strategy  for  conducting  quality 
assurance  is  developed; 

GP  2.2  Establish  and  maintain  the  plan  for  performing 
the  process. 

b)  evidence  of  software  quality  assurance  is 
produced  and  maintained; 

GP  2.9  Objectively  evaluate  adherence  of  the  process 
and  selected  work  products  against  the  process 
description,  standards,  and  procedures,  and  address 
noncompliance. 

PPQA  SG  1  Adherence  of  the  performed  process  and 
associated  work  products  and  services  to  applicable 
process  descriptions,  standards,  and  procedures  is 
objectively  evaluated. 

c)  problems  and/or  non-conformance  with 
requirements  are  identified  and  recorded; 
and 

PPQA  SG  2  Noncompliance  issues  are  objectively 
tracked  and  communicated,  and  resolution  is  ensured. 

d)  adherence  of  products,  processes  and 
activities  to  the  applicable  standards, 
procedures  and  requirements  are  verified. 

VER  SG  1  Preparation  for  verification  is  conducted. 

VER  SG  2  Peer  reviews  are  performed  on  selected 
work  products. 

VER  SG  3  Selected  work  products  are  verified  against 
their  specified  requirements. 

©2011  Walz  17 


P730  /  IS  12207  SQA  Tasks 

IS  12207  SQA  Process  Tasks 

1.1  A  quality  assurance  process  suited  to  the  project  shall  be  established.  The  objectives  of  the  quality  assurance 
process  shall  be  to  assure  that  the  software  products  and  the  processes  employed  for  providing  those  software 
products  comply  with  their  established  requirements  and  adhere  to  their  established  plans. 

1.2  The  quality  assurance  process  should  be  coordinated  with  the  related  Software  Verification  (subclause  7.2.4), 

Software  Validation  (subclause  7.2.5),  Software  Review  (subclause  7.2.6),  and  Software  Audit  (subclause  7.2.7) 
Processes. 

1.3  A  plan  for  conducting  the  quality  assurance  process  activities  and  tasks  shall  be  developed,  documented, 
implemented,  and  maintained  for  the  life  of  the  contract.  The  plan  shall  include  the  following: 

a)  Quality  standards,  methodologies,  procedures,  and  tools  for  performing  the  quality  assurance  activities  (or  their 
references  in  organization's  official  documentation). 

b)  Procedures  for  contract  review  and  coordination  thereof. 

c)  Procedures  for  identification,  collection,  filing,  maintenance,  and  disposition  of  quality  records. 

d)  Resources,  schedule,  and  responsibilities  for  conducting  the  quality  assurance  activities. 

e)  Selected  activities  and  tasks  from  supporting  processes,  such  as  Software  Verification  (subclause  7.2.4),  Software 
Validation  (subclause  7.2.5),  Software  Review  (subclause  7.2.6),  Software  Audit  (subclause  7.2.7),  and  Software 
Problem  Resolution  (subclause  7.2.8). 

1.4  Scheduled  and  on-going  quality  assurance  activities  and  tasks  shall  be  executed.  When  problems  or  non¬ 
conformances  with  contract  requirements  are  detected,  they  shall  be  documented  and  serve  as  input  to  the  Problem 
Resolution  Process  (subclause  7.2.8).  Records  of  these  activities  and  tasks,  their  execution,  problems,  and  problem 
resolutions  shall  be  prepared  and  maintained. 

1.5  Records  of  quality  assurance  activities  and  tasks  shall  be  made  available  to  the  acquirer  as  specified  in  the  contract. 

1.6  It  shall  be  assured  that  persons  responsible  for  assuring  compliance  with  the  contract  requirements  have  the 
organizational  freedom,  resources,  and  authority  to  permit  objective  evaluations  and  to  initiate,  effect,  resolve,  and 
verify  problem  resolutions. 
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P730  /  IS  1 2207  Tasks 


IS  1 2207  SQA  Process  Tasks 


2.1  It  shall  be  assured  that  all  the  plans  required  by  the  contract  are  documented,  comply  with  the 
contract,  are  mutually  consistent,  and  are  being  executed  as  required. 

2.2  It  shall  be  assured  that  software  products  and  related  documentation  comply  with  the  contract 
and  adhere  to  the  plans. 

2.3  In  preparation  for  the  delivery  of  the  software  products,  it  shall  be  assured  that  they  have  fully 
satisfied  their  contractual  requirements  and  are  acceptable  to  the  acquirer. 

3.1  It  shall  be  assured  that  those  software  life  cycle  processes  (supply,  development,  operation, 
maintenance,  and  support  processes  including  quality  assurance)  employed  for  the  project  comply 
with  the  contract  and  adhere  to  the  plans. 

3.2  It  shall  be  assured  that  the  internal  software  engineering  practices,  development  environment, 
test  environment,  and  libraries  comply  with  the  contract. 

3.3  It  shall  be  assured  that  applicable  prime-contract  requirements  are  passed  down  to  the 
subcontractor,  and  that  the  subcontractor's  software  products  satisfy  prime-contract  requirements. 


3.4  It  shall  be  assured  that  the  acquirer  and  other  parties  are  provided  the  required  support  and 
cooperation  in  accordance  with  the  contract,  negotiations,  and  plans. 

3.5  It  should  be  assured  that  software  product  and  process  measurements  are  in  accordance  with 
established  standards  and  procedures. 

3.6  It  shall  be  assured  that  the  staff  assigned  have  the  skill  and  knowledge  needed  to  meet  the 
requirements  of  the  project  and  receive  any  necessary  training. 


4.1  Additional  quality  management  activities  may  be  assured  in  accordance  with  the  clauses  of  ISO 
9001. 


Map  Process  Areas  to  P730  Tasks 


CMMI  has  several  Process  Areas  whose  Specific  Practices  (SP)  and 
two  overall  General  Practices  (GP)  related  to  IEEE  730  15  of  the  16  Tasks. 


CMMI  Specific  Practices  (SP)  and 

Generai  Practices  (GP) 

730  Tasks 

PPQASP1.1  Objectively  evaluate  selected  performed  processes  against 
applicable  process  descriptions,  standards,  and  procedures. 

1.1 

3.1 

3.2 

3.5 

PPQA  SP1.2  Objectively  evaluate  selected  work  products  against  applicable 
process  descriptions,  standards,  and  procedures. 

1.1 

2.1 

2.3 

3.5 

PPQA  SP  2.1  Communicate  quality  issues  and  ensure  the  resolution  of 

1.4 

noncompliance  issues  with  the  staff  and  managers. 

1.6 

PPQA  SP  2.2  Establish  and  maintain  records  of  the  quality  assurance 
activities. 

1.5 

VER  SP  1.1  Select  work  products  to  be  verified  and  verification  methods  to 

2.1 

be  Used 

3.3 

VER  SP  2.2  Conduct  peer  reviews  of  selected  work  products  and  identify 
issues  resulting  from  these  reviews. 

2.2 

VER  SP  2.3  Analyze  data  about  the  preparation,  conduct,  and  results  of  the 

2.2 

peer  reviews 

3.3 

VER  SP  3.2  Analyze  results  of  all  verification  activities 

2.2 

2.3 

3.3 

Map  PPQA  &  VER  to  P730  Tasks, 

continued 


CMMI  Specific  Practices  (SP)  and 

Generai  Practices  (GP) 

730  Tasks 

OPD  SP  1.1  Establish  and  maintain  the  organization’s  set  of  standard 
processes,  (especially  subpratice  6  --  Ensure  that  there  is  appropriate 
integration  among  processes  that  are  included  in  the  organization’s  set  of 
standard  processes) 

1.2 

OPF  SP  3.2  Deploy  the  organization’s  set  of  standard  processes  to  projects 
at  their  startup  and  deploy  changes  to  them  as  appropriate  throughout  the 
life  of  each  project,  (especially  subpractice  6  --  Ensure  that  the  defined 
processes  resulting  from  process  tailoring  are  incorporated  into  plans  for 
process-compliance  audits) 

OT  SP  2.1  Deliver  training  following  the  organizational  training  tactical  plan. 

3.6 

GP  2.1  Establish  and  maintain  the  plan  for  performing  the  process. 

1.3 

GP  2.3  Provide  adequate  resources  for  performing  the  process,  developing 
the  work  products,  and  providing  the  services  of  the  process. 

3.4 

Missing  from  CMMi 

4.1 

Mapping  Typical  Work  Products  (WP) 

Each  CMMI  Process  Area  Specific  Practices  have  examples  of  Work  Products. 
Below  table  show  the  best  match  to  IEEE  730  Outcome  typical  deliverables  as 
named  by  IS  15289  Information  Products. 


SPWP 

SP  Work  Products  examples 

IS  15289  SQA  Info  Products 

1.1.WP.1 

Evaluation  reports 

10.22  Evaluation  report 

1.1.WP.2 

Noncompliance  reports 

10.41  Problem  report 

1.1.WP.3 

Corrective  actions 

Quality  Activity  Record 

1.2.WP.1 

Evaluation  reports 

10.22  Evaluation  report 

1.2.WP.2 

Noncompliance  reports 

10.41  Problem  report 

1.2.WP.3 

Corrective  actions 

Quality  Activity  Record 

2.1.WP.1 

Corrective  action  reports 

Quality  Activity  Record 

2.1.WP.2 

Evaluation  reports 

10.22  Evaluation  report 

2.1.WP.3 

Quality  trends 

2.2.WP.1 

Evaluation  logs 

10.22  Evaluation  report 

2.2.WP.2 

Quality  assurance  reports 

Quality  Activity  Record 

2.2.WP.3 

Status  reports  of  corrective  actions 

Quality  Activity  Record 

2.2.WP.4 

Reports  of  quality  trends 
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Conclusion:  Good  Fit 
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Acronyms 

•  CMMI  Capability  Maturity  Model  Integration 

•  CMMI-DEV  CMMI  for  Development 

•  GP  generic  practice 

•  IEEE  Institute  of  Electrical  and  Electronics  Engineers 

•  IEEE  15288  system  engineering  life  cycle  processes 

•  IEEE  12207  software  engineering  life  cycle  processes 

•  IS  International  Standard,  lEEE/ISO/lEC 

•  ISO/IEC  International  Organization  for  Standardization  and 
International  Electrotechnical  Commission 

•  PPQA  Process  and  Product  Quality  Assurance  (process  area) 

•  SQA  software  quality  assurance 

•  SCAMPI  Standard  CMMI  Appraisal  Method  for  Process  Improvement 

•  SG  specific  goal 

•  SP  specific  practice 

•  VER  Verification  (process  area) 
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Where  you  can  help? 

•  Attend  a  working  group  meeting  in  person 
or  via  LiveMeeting  and  phone, or 

•  Follow  the  working  group  progress,  or 

•  Review  the  draft  standard,  or 

•  Ballot  for  the  final  standard,  or 

•  Participant  in  the  User  Group 

•  Send  email  to  sue.carroll@sas.com  and 
ask  to  be  part  of  the  listserv 
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